Към съдържанието
Търсене

CVE-2026-43455: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key->lock in mctp_flow_prepare_output() mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctp_flow_prepare_output(key, devA) if (!key->dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key->dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key->dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call.

    Засегнати продукти

    • Linux Linux: 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 47893166bc5611ee9a20de6b8d2933b2320fb772; 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 86f5334fcb48a5b611c33364ab52ca684d0f6d91; 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 0695712f3a6f1a48915f95767cfb42077683dcdc; 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f; 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 8d27d9b260dd19c1b519e1a13de6448f9984e30e; 67737c457281dd199ceb9e31b6ba7efd3bfe566d преди 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a
    • Linux Linux: 5.16; преди 5.16; 6.1.167 до 6.1.*; 6.6.130 до 6.6.*; 6.12.78 до 6.12.*; 6.18.19 до 6.18.*; 6.19.9 до 6.19.*; 7.0 до *

    История

    • 8 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-43455: Linux | freedomonline.bg